Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    132s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/05/2024, 16:35

General

  • Target

    SCAN_814216796997US_May_11_2019.js

  • Size

    4KB

  • MD5

    ddea80fd1df1098ed6465f835554e639

  • SHA1

    3e27ffd7c2bcb4fdd2af9a0adda0dc47dd7470c6

  • SHA256

    2b695b354e1485292556309baf5e876b4a7ba956bedf9c2bfab60b3ecbe625c8

  • SHA512

    b5f67de8b4320bf1eb299b013a4c3922883df77ba73986960d080263d00ad77cb6b623057dce1e93e654e3640683d8cfebeeed0ca5b2d4c64ee73f8fd86056ff

  • SSDEEP

    48:YFpkufv1+YuUIxJ3+4EYoOVOEBtXZpzKHFIqgAiXXZnTLMn6uoL/xkVB3EiYPmv4:Yf3v1+akETwjqgps4GEPmeV

Score
8/10

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\SCAN_814216796997US_May_11_2019.js
    1⤵
    • Blocklisted process makes network request
    • Checks computer location settings
    PID:1236

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\t7frnnba0.exe

    Filesize

    114B

    MD5

    e89f75f918dbdcee28604d4e09dd71d7

    SHA1

    f9d9055e9878723a12063b47d4a1a5f58c3eb1e9

    SHA256

    6dc9c7fc93bb488bb0520a6c780a8d3c0fb5486a4711aca49b4c53fac7393023

    SHA512

    8df0ab2e3679b64a6174deff4259ae5680f88e3ae307e0ea2dfff88ec4ba14f3477c9fe3a5aa5da3a8e857601170a5108ed75f6d6975958ac7a314e4a336aed0